Guide · Agent skill
How to use the Offensive OSINT Methodology agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-osint-methodology skill is a packaged instruction file (SKILL.md) that makes Claude follow a structured open-source intelligence checklist. It is aimed at security researchers, trainers, students and investigators who want a repeatable process rather than ad hoc searching. After this guide you will know what the skill changes about the agent's behaviour, how to install it, which phrases trigger it, and where its limits are.
Offensive OSINT MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the offensive-osint-methodology ZIP from the directory page.
- 2Unzip into a skills folder. Extract it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project.
- 3Or upload in the Claude apps. If you use the Claude apps, open Settings, choose Capabilities, then Skills, and upload the skill.
- 4Define your target and lawful basis. Decide what you are investigating and confirm you have a lawful reason to collect information on it.
- 5Send a trigger request. Ask in plain language using a trigger phrase such as OSINT workflow or open source intelligence, and name the target.
- 6Work through the checklist. Let the agent proceed step by step, and ask it to report which items are complete and what to do next.
- 7Record your actions. Keep timestamps, hashes of key artifacts and tool versions for each case, as the source recommends.
What does the offensive-osint-methodology skill make the agent do?
Once the skill is active, the agent treats the methodology as its operating checklist. The source instructs it to follow the steps in order unless you say otherwise, consider how each technique applies to the current target, track which items are complete, and suggest next steps based on findings.
The checklist covers target definition, source selection, collection workflows, data correlation, timeline reconstruction and reporting. It also includes sections on operational security, cryptocurrency investigation (transaction analysis, wallet and exchange profiling, layer 2 and bridge tracing) and image analysis with reverse image search and EXIF metadata.
- Works through target definition, source selection, collection, correlation, timeline and reporting in order
- Tracks completed checklist items during the conversation
- Suggests next steps from what has been found
- Adds guidance on OpSec, crypto tracing and image analysis
How do you install the offensive-osint-methodology skill?
Download the ZIP for the skill from the directory page. Unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there. The package contains a single file, SKILL.md.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload
How do you trigger the skill with natural requests?
The skill activates when your conversation involves its trigger phrases. You do not need to type a command. Phrase your request in plain language that uses one of the terms the skill listens for, and name the target or goal so the agent knows what the checklist applies to.
The trigger phrases listed in the source are: OSINT methodology, open source intelligence, target profiling, data correlation, OSINT workflow, intelligence collection, OSINT campaign and recon methodology.
- Plan an OSINT campaign for a company's public infrastructure, starting with target definition
- Walk me through an OSINT workflow for building a timeline of events from public sources
- Use an OSINT methodology to teach students how to correlate data from several sources
- Start a recon methodology review and tell me what step we are on
What do you need before you start, and what are the safety notes?
The source lists no required tools, does not run scripts and does not use the network. The skill is a text checklist, so the agent's own capabilities determine what searches it can actually perform.
The file itself carries risks you should weigh. Its OpSec section recommends sock puppet accounts and fake personas, which can breach platform terms and privacy law. It names specific tools and services that may have changed, and some linked resources are older or unverified. It also says vendor labels can disagree and should be treated as hypotheses, not ground truth. The skill is not a substitute for legal advice on evidence handling or cross-border data collection.
- Confirm you have a lawful basis before investigating any private individual
- Do not assume the named tools or links are current; check them yourself
- Treat blockchain labels and attributions as hypotheses that need corroboration
- Get legal advice on evidence handling and cross-border collection
- The source suggests timestamping actions, hashing key artifacts and recording tool versions per case
What are practical tips for getting good results?
Give the agent the target, the question you need answered and the jurisdiction or context, so it can decide which checklist items apply. Ask it to log completed steps so you can review the sequence later, which supports the chain-of-custody practice the source recommends.
For crypto work, the source suggests starting from layer 1 bridge events, because deposits and withdrawals anchor layer 2 activity to known addresses. For images, it suggests running several reverse image search engines and checking EXIF metadata for location or device details.
- State the target, goal and context in the first message
- Ask the agent to track checklist progress across the session
- Cross-check findings across multiple datasets and sources
- For images, compare results from several reverse image search engines
What people use it for
- Planning a structured open-source investigation with defined targets, sources and reporting stages
- Teaching an OSINT methodology to students as a step-by-step checklist
- Mapping how funds move between addresses on public blockchain explorers, including bridges and rollups
- Building a timeline from public sources and correlating findings across them
- Working through reverse image search and EXIF checks on a set of photos
Frequently asked questions
How do I install the offensive-osint-methodology skill?
Download the ZIP from the directory page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, Capabilities, Skills.
Is the offensive-osint-methodology skill free to use?
The source states the skill is licensed under MIT. Some tools the checklist names are paid services, such as Chainalysis Horizon 2.0, but the skill itself is a text file.
Does the skill need API keys, extra software or internet access?
The source lists no requirements, says it runs no scripts and does not use the network. Any searches the agent performs depend on the tools available in your own setup.
Why isn't my skill triggering?
Use one of the listed trigger phrases, such as OSINT methodology or recon methodology, in your request. Also check that the folder is in the correct skills location; the source lists the skill name as osint-methodology inside a folder named offensive-osint-methodology.
What are alternatives to this OSINT methodology skill?
The source does not compare this skill with other products or methodologies, so it cannot tell you how it ranks against them. It is a checklist framework, not a tool, so you can also follow a methodology written by a training provider or your own organisation alongside it.
Is it legal to use the sock puppet advice in this skill?
Not automatically. The file recommends sock puppet accounts and fake personas, which can breach platform terms and privacy law. Confirm a lawful basis and get legal advice before following that section.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security researchers, trainers and compliance or journalism analysts who want a disciplined, ordered OSINT checklist that an agent can track and extend. It is a poor fit for investigating private individuals without a lawful basis, for anyone who needs verified and current tool information, or as a replacement for legal advice on evidence and cross-border data.
Download the skill